CVE-2014-2210

Múltiples vulnerabilidades de salto de directorio en el portal web de CA ERwin 9.5 permiten a atacantes remotos obtener información sensible, evadir restricciones de acceso, causar una denegación de servicio o posiblemente ejecutar código arbitrario a través de vectores no especificados.

This vulnerability allows remote attackers to read arbitrary files on a system with vulnerable installations of CA ERwin Web Portal's Meta Integration Metadata Management service. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the "Meta Integration Web Server and Services" ProfileIconServlet which is vulnerable to directory traversals in multiple parameters. An attacker can leverage these vulnerabilities to read arbitrary files, including files which store database credentials, under the context of SYSTEM. An attacker can couple this vulnerability with others to gain remote code execution.

CA Technologies Support is alerting customers to multiple vulnerabilities with CA Erwin Web Portal version 9.5. The vulnerabilities occur due to insufficient path verification. A remote unauthenticated attacker can use directory traversal attacks to gain sensitive information, cause a denial of service condition, gain additional access, or potentially execute arbitrary code.